From nobody Mon Sep 29 21:22:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DFABC25B0D for ; Tue, 16 Aug 2022 04:47:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231576AbiHPErV (ORCPT ); Tue, 16 Aug 2022 00:47:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231906AbiHPEoe (ORCPT ); Tue, 16 Aug 2022 00:44:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78B5DD475B; Mon, 15 Aug 2022 13:40:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C9E51B8114A; Mon, 15 Aug 2022 20:40:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32E60C433C1; Mon, 15 Aug 2022 20:40:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660596043; bh=t5ImEyorQ3i44pNr0mQgsCc6Po4wNQF3sy5vCvr2iNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hC0f5u5PlGhIiLdMUWk8HbIIaqTdvo95czelstBMbEtqRwUSTsI62AGfNGXRc1Y5H B+HpdTJ/omdJBvgPw8tSTZxO8v7isTrMJdU0B2NfZD9QqVAJ7elTIqpCqPnGItgBVr Q2NrPWBq5E5OXyQI2zxnzHI5mTzGoFjf5SyZVmP4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Mark Brown , Sasha Levin Subject: [PATCH 5.19 0955/1157] ASoC: SOF: ipc-msg-injector: fix copy in sof_msg_inject_ipc4_dfs_write() Date: Mon, 15 Aug 2022 20:05:11 +0200 Message-Id: <20220815180517.825168254@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit fa9b878ff86f4adccddf62492a5894fbdb04f97d ] There are two bugs that have to do with when we copy the payload: size =3D simple_write_to_buffer(ipc4_msg->data_ptr, priv->max_msg_size, ppos, buffer, count); The value of "*ppos" was supposed to be zero but it is sizeof(ipc4_msg->header_u64) so it will copy the data into the middle of the "ipc4_msg->data_ptr" buffer instead of to the start. The second problem is "buffer" should be "buffer + sizeof(ipc4_msg->header_u64)". This function is used for fuzz testing so the data is normally random and this bug likely does not affect anyone very much. In this context, it's simpler and more appropriate to use copy_from_user() instead of simple_write_to_buffer() so I have re-written the function. Fixes: 066c67624d8c ("ASoC: SOF: ipc-msg-injector: Add support for IPC4 mes= sages") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Ysg1tB2FKLnRMsel@kili Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- sound/soc/sof/sof-client-ipc-msg-injector.c | 29 +++++++++------------ 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/sound/soc/sof/sof-client-ipc-msg-injector.c b/sound/soc/sof/so= f-client-ipc-msg-injector.c index 6bdfa527b7f7..752d5320680f 100644 --- a/sound/soc/sof/sof-client-ipc-msg-injector.c +++ b/sound/soc/sof/sof-client-ipc-msg-injector.c @@ -181,7 +181,7 @@ static ssize_t sof_msg_inject_ipc4_dfs_write(struct fil= e *file, struct sof_client_dev *cdev =3D file->private_data; struct sof_msg_inject_priv *priv =3D cdev->data; struct sof_ipc4_msg *ipc4_msg =3D priv->tx_buffer; - ssize_t size; + size_t data_size; int ret; =20 if (*ppos) @@ -191,25 +191,20 @@ static ssize_t sof_msg_inject_ipc4_dfs_write(struct f= ile *file, return -EINVAL; =20 /* copy the header first */ - size =3D simple_write_to_buffer(&ipc4_msg->header_u64, - sizeof(ipc4_msg->header_u64), - ppos, buffer, count); - if (size < 0) - return size; - if (size !=3D sizeof(ipc4_msg->header_u64)) + if (copy_from_user(&ipc4_msg->header_u64, buffer, + sizeof(ipc4_msg->header_u64))) return -EFAULT; =20 - count -=3D size; + data_size =3D count - sizeof(ipc4_msg->header_u64); + if (data_size > priv->max_msg_size) + return -EINVAL; + /* Copy the payload */ - size =3D simple_write_to_buffer(ipc4_msg->data_ptr, - priv->max_msg_size, ppos, buffer, - count); - if (size < 0) - return size; - if (size !=3D count) + if (copy_from_user(ipc4_msg->data_ptr, + buffer + sizeof(ipc4_msg->header_u64), data_size)) return -EFAULT; =20 - ipc4_msg->data_size =3D count; + ipc4_msg->data_size =3D data_size; =20 /* Initialize the reply storage */ ipc4_msg =3D priv->rx_buffer; @@ -221,9 +216,9 @@ static ssize_t sof_msg_inject_ipc4_dfs_write(struct fil= e *file, =20 /* return the error code if test failed */ if (ret < 0) - size =3D ret; + return ret; =20 - return size; + return count; }; =20 static int sof_msg_inject_dfs_release(struct inode *inode, struct file *fi= le) --=20 2.35.1